00640000.cpp

#include <windows.h>
#include "Globals.h"
#include "Prototypes.h"

// --- Environment Detection: OS Version and Process Name ---
void __declspec(naked) sub_64a880()
{
    __asm {
        push    ebp
        mov     ebp, esp
        sub     esp, 0x184
        push    ebx
        push    esi
        push    edi

        // Check Windows Version
        call    dword ptr[GetVersion]
        mov[ebp - 0x04], eax
        xor eax, eax
        test    eax, eax
        je      loc_64a8c0

        mov     ecx, [ebp - 0x04]
        and ecx, 0xFF
        cmp     ecx, 4
        jg      loc_64a8c0

        // Fallback for specific environments (e.g., NT4)
        push    offset data_7d94b8 // "NT4"
        push    offset data_1419a50
        call    vc6_strcpy
        add     esp, 8
        jmp     loc_64aa93

        loc_64a8c0 :
        // Dynamically load Toolhelp functions for compatibility
        push    offset data_7d94a8 // "kernel32.dll"
            call    dword ptr[LoadLibraryA]
            mov[ebp - 0x08], eax
            cmp     dword ptr[ebp - 0x08], 0
            jne     loc_64a8d9
            jmp     loc_64aa93

            loc_64a8d9 :
        push    offset data_7d9488 // "CreateToolhelp32Snapshot"
            mov     edx, [ebp - 0x08]
            push    edx
            call    dword ptr[GetProcAddress]
            mov[data_18a4254], eax
            cmp     dword ptr[data_18a4254], 0
            jne     loc_64a8fb
            jmp     loc_64aa93

            loc_64a8fb :
        push    offset data_7d9474 // "Process32First"
            mov     eax, [ebp - 0x08]
            push    eax
            call    dword ptr[GetProcAddress]
            mov[data_18a4250], eax
            cmp     dword ptr[data_18a4250], 0
            jne     loc_64a91d
            jmp     loc_64aa93

            loc_64a91d :
        push    offset data_7d9464 // "Process32Next"
            mov     ecx, [ebp - 0x08]
            push    ecx
            call    dword ptr[GetProcAddress]
            mov[data_18a424c], eax
            cmp     dword ptr[data_18a424c], 0
            jne     loc_64a93f
            jmp     loc_64aa93

            loc_64a93f :
        mov     edx, [ebp - 0x08]
            push    edx
            call    dword ptr[FreeLibrary]

            // Get PID to find parent process
            call    dword ptr[GetCurrentProcessId]
            mov[ebp - 0x0C], eax
            mov     dword ptr[ebp - 0x10], 0

            push    0
            push    0x0F            // TH32CS_SNAPPROCESS
            call    dword ptr[data_18a4254]
            mov[ebp - 0x14], eax

            // Initialize PROCESSENTRY32
            push    0x128           // sizeof(PROCESSENTRY32)
            push    0
            lea     eax, [ebp - 0x13c]
            push    eax
            call    vc6_memset
            add     esp, 0x0C

            mov     dword ptr[ebp - 0x13c], 0x128 // pe.dwSize
            lea     ecx, [ebp - 0x13c]
            push    ecx
            push    dword ptr[ebp - 0x14]
            call    dword ptr[data_18a4250]
            mov[ebp - 0x140], eax

            loc_64a99d :
        // Loop to find current process and its parent
        cmp     dword ptr[ebp - 0x140], 0
            je      loc_64a9d5
            mov     eax, [ebp - 0x134] // pe.th32ProcessID
            cmp     eax, [ebp - 0x0C]
            jne     loc_64a9bc
            mov     ecx, [ebp - 0x124] // pe.th32ParentProcessID
            mov[ebp - 0x10], ecx
            jmp     loc_64a9d5

            loc_64a9bc :
        lea     edx, [ebp - 0x13c]
            push    edx
            push    dword ptr[ebp - 0x14]
            call    dword ptr[data_18a424c]
            mov[ebp - 0x140], eax
            jmp     loc_64a99d

            loc_64a9d5 :
        // Check if parent ID was found
        cmp     dword ptr[ebp - 0x10], 0
            jne     loc_64a9ea
            push    dword ptr[ebp - 0x14]
            call    dword ptr[CloseHandle]
            jmp     loc_64aa93

            loc_64a9ea :
        // Restart search to find parent process name
        lea     edx, [ebp - 0x13c]
            push    edx
            push    dword ptr[ebp - 0x14]
            call    dword ptr[data_18a4250]
            mov[ebp - 0x140], eax

            loc_64aa01 :
        cmp     dword ptr[ebp - 0x140], 0
            je      loc_64aa89
            mov     ecx, [ebp - 0x134] // pe.th32ProcessID
            cmp     ecx, [ebp - 0x10]
            jne     loc_64aa6d

            // Extract filename from path
            push    0x5C            // '\\'
            lea     edx, [ebp - 0x118] // pe.szExeFile
            push    edx
            call    vc6_strrchr
            add     esp, 8
            mov[ebp - 0x144], eax
            cmp     dword ptr[ebp - 0x144], 0
            jne     loc_64aa43
            lea     eax, [ebp - 0x118]
            mov[ebp - 0x144], eax
            jmp     loc_64aa52

            loc_64aa43 :
        mov     ecx, [ebp - 0x144]
            add     ecx, 1
            mov[ebp - 0x144], ecx

            loc_64aa52 :
        // Copy name to global buffer
        push    0xC0
            mov     edx, [ebp - 0x144]
            push    edx
            push    offset data_1419a50
            call    vc6_strncpy
            add     esp, 0x0C
            jmp     loc_64aa89

            loc_64aa6d :
        lea     eax, [ebp - 0x13c]
            push    eax
            push    dword ptr[ebp - 0x14]
            call    dword ptr[data_18a424c]
            mov[ebp - 0x140], eax
            jmp     loc_64aa01

            loc_64aa89 :
        mov     edx, [ebp - 0x14]
            push    edx
            call    dword ptr[CloseHandle]

            loc_64aa93 :
            pop     edi
            pop     esi
            pop     ebx
            mov     esp, ebp
            pop     ebp
            ret
    }
}

void __declspec(naked) sub_64a7d0() {
    __asm {
        push    ebp
        mov     ebp, esp
        sub     esp, 0x4c
        push    ebx
        push    esi
        push    edi

        // Check if global object pointer is NULL
        cmp     dword ptr[data_18a4b8c], 0
        je      loc_cleanup_ptr

        // Prepare this-pointer and call scalar deleting destructor
        mov     eax, dword ptr[data_18a4b8c]
        mov[ebp - 0x08], eax
        mov     ecx, [ebp - 0x08]
        mov[ebp - 0x04], ecx

        cmp     dword ptr[ebp - 0x04], 0
        je      loc_set_res_null

        // push 1 indicates: call destructor AND operator delete
        push    1
        mov     ecx, [ebp - 0x04]
        call    sub_64a830
        mov[ebp - 0x0c], eax
        jmp     loc_cleanup_ptr

        loc_set_res_null :
        mov     dword ptr[ebp - 0x0c], 0

            loc_cleanup_ptr :
            // Null the global pointer
            mov     dword ptr[data_18a4b8c], 0

            pop     edi
            pop     esi
            pop     ebx
            mov     esp, ebp
            pop     ebp
            ret
    }
}

void __declspec(naked) sub_64a830() {
    __asm {
        push    ebp
        mov     ebp, esp
        sub     esp, 0x44
        push    ebx
        push    esi
        push    edi

        // Store this-pointer
        mov[ebp - 0x04], ecx

        // Call the real destructor (sub_5f8960)
        mov     ecx, [ebp - 0x04]
        call    sub_5f8960

        // Check if we should free the memory (flag in [ebp + 8])
        mov     eax, [ebp + 0x08]
        and eax, 1
        test    eax, eax
        jz      loc_exit

        // Call operator delete(this)
        mov     ecx, [ebp - 0x04]
        push    ecx
        call    vc6_delete
        add     esp, 0x04

        loc_exit:
        mov     eax, [ebp - 0x04]
            pop     edi
            pop     esi
            pop     ebx
            mov     esp, ebp
            pop     ebp
            retn    0x04
    }
}